I was recently assigned the task of testing a new hardware device which communicates with a JSON API over UDP.
For some reason or another, it was decided that AES-CBC-128 should be used to encrypt the traffic. I believe this was to prevent someone from creating their own software/script that interfaces with this board (which is proprietary) by obfuscating the API. The party responsible for the board from what I understand has accommodated for replay and man-in-the-middle attacks.
Otherwise, the encryption is enabled in production where we can set the cipher key and the initialized vector being used. Ultimately the computer along with all the connected devices will be shipped with the encryption enabled to a client. It makes me wary that this methodology means that the key is set and never changed.
My plan was to store this key locally in an encrypted file on the local filesystem. Is there any problem with this? As it is blatantly obvious - I am no expert at security. The computer shipped with the product will be on an active network as well. The lack of authentication worries me as well. Will such a thing be necessary here?